.Dd Jul 10, 2025
.Dt RAFIND2 1
.Sh NAME
.Nm rafind2
.Nd advanced command-line byte pattern search in files
.Sh SYNOPSIS
.Nm rafind2
.Op Fl mBXnzZhqv
.Op Fl a Ar align
.Op Fl b Ar size
.Op Fl f Ar from
.Op Fl t Ar to
.Op Fl [e|s|S] Ar str
.Op Fl x Ar hex
.Op Fl E
.Op Fl F Ar file
.Op Fl i
.Op Fl j
.Op Fl L
.Op Fl M Ar str
.Op Fl r
.Op Fl c
.Op Fl V Ar s:num | s:num1,num2
.Ar -|file|dir ...
.Sh DESCRIPTION
A versatile utility for searching byte patterns in files, supporting alignment, offset ranges, string and hexadecimal queries, and customizable output formats.
.Pp
The following options are available:
.Bl -tag -width Fl
.It Fl a Ar align
Only accept aligned hits
.It Fl b Ar size
Set block size
.It Fl B
Use big endian instead of little endian (See -V)
.It Fl c
Disable colorful output (mainly for for -X)
.It Fl e Ar regex
Search for regex matches (can be used multiple times)
.It Fl E
Perform a search using an esil expression
.It Fl f Ar from
Start searching from address 'from'
.It Fl F Ar file
Read the contents of the file and use it as keyword
.It Fl h
Show help message
.It Fl i
Identify filetype (r2 -nqcpm file)
.It Fl j
Output in JSON
.It Fl L
List all IO plugins (same as r2 for now)
.It Fl m
Magic search, file-type carver
.It Fl M Ar str
Set a binary mask to be applied on keywords
.It Fl n
Do not stop on read errors
.It Fl r
Print using radare commands
.It Fl s Ar str
Search for a string (more than one string can be passed)
.It Fl S Ar str
Search for a wide string (more than one string can be passed)
.It Fl t Ar to
Stop search at address 'to'
.It Fl q
Quiet mode: fewer output do not show headings or filenames
.It Fl v
Show version information
.It Fl V Ar s:num | s:num1,num2
Search for a value or range in the specified endian (-V 4:123 or -V 4:100,200)
.It Fl x Ar hex
Search for hexpair string (909090) (can be used multiple times)
.It Fl X
Show hexdump of search results
.It Fl z
Search for zero-terminated strings
.It Fl Z
Show string found on each search hit
.El
.Sh ENVIRONMENT
.Pp
rafind2 does not use any environment variables.
.Sh EXAMPLES
.Pp
Search for a specific string in a file:
.Bd -literal -offset indent
$ rafind2 -s "search_string" file.txt
.Ed
.Pp
Search for a hex pattern in all the files from directory:
.Bd -literal -offset indent
$ rafind2 -x "909090" directory_path
.Ed
.Pp
Identify the file type:
.Bd -literal -offset indent
$ rafind2 -i binary_file
.Ed
.Pp
Search for the little endian 123 stored in a 4-byte word:
.Bd -literal -offset indent
$ rafind2 -V 4:123 file.bin
.Ed
.Pp
Search for a range of values (100-200) in a 4-byte word:
.Bd -literal -offset indent
$ rafind2 -V 4:100,200 file.bin
.Ed
.Pp
Search for zero-terminated strings and show each string found:
.Bd -literal -offset indent
$ rafind2 -zZ file.bin
.Ed
.Pp
Search using regex pattern:
.Bd -literal -offset indent
$ rafind2 -e "password|passwd" file.txt
.Ed
.Pp
Show hexdump of search results:
.Bd -literal -offset indent
$ rafind2 -X -s "hello" file.bin
.Ed
.Sh SEE ALSO
.Pp
.Xr radare2 1
.Sh AUTHORS
.Pp
pancake <pancake@nopcode.org>